PT-2026-28307 · Microchip · Microchip Timeprovider 4100

Andrea Sindoni + 8 · Publicado 2026-03-28 · Atualizado 2026-03-28 · CVE-2025-9497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microchip Time Provider 4100 versions prior to 2.5.0

Description A use of hard-coded credentials issue exists in Microchip Time Provider 4100, potentially allowing for malicious manual software updates.

Recommendations Update Microchip Time Provider 4100 to version 2.5.0 or later.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-9497

Produtos afetados

Microchip Timeprovider 4100

Referências · 5

• https://twitter.com/VulmonFeeds/status/2037857265655349735 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2037945971846615508 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9497 · Nota de Segurança
• https://microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-hardcoded-upgrade-decryption-passwords · Aviso do Fabricante
• https://gruppotim.it/en/footer/TIM-red-team.html · Nota